download_endpoint: Adds support for expiring URLs

[davidwessman]

• Adds expires_in and secret_key to download_endpoint plugin
• This allows calling attachment.download_url(expires_in: 5 * 60)
  to generate a URL including signature and expires_at as query parameters. The timestamp is included in the signature and will only work before that timestamp.
• The URL is signed and verified with HMAC with SHA256 digest.

[adam12]

I suspect the use of AS::Verifier is going to be an issue. We might need to go with OpenSSL::HMAC directly.

[davidwessman]

I suspect the use of AS::Verifier is going to be an issue. We might need to go with OpenSSL::HMAC directly.

I'll try it out 🙂

[janko]

Yes, Shrine doesn't depend on Active Support, so I want to avoid it if possible, even as an optional dependency. The derivation_endpoint plugin has URL signing implemented using OpenSSL::HMAC, so you can take a look there.

[davidwessman]

Now I rewrote it to use OpenSSL-directly 🙂
Not sure if some of this functionality should be extracted to the UrlSigner class.

[adam12]

Nicely done adapting it for OpenSSL::HMAC. Few comments but overall looks good IMHO. Will leave final sign-off for Janko ofc.

[davidwessman]

@janko could you allow the tests to run? They crash on my side because of libmagic

[davidwessman]

@janko Sorry for a second (and last) ping, do you think there would be bandwidth for handling this PR within November?
Totally understandable if you do not know, trying to plan our alternatives with some deadlines coming up.
Thank you for great gems! 🙂

[adam12]

Please rebase if willing. Then we can trigger tests to run and maybe get this over the finish line.

[davidwessman]

Please rebase if willing. Then we can trigger tests to run and maybe get this over the finish line.

Now I have rebased it, please trigger the tests 🙂

[adam12]

This looks good! Nicely done.

I'll merge later today.